fix(secrets): make apply idempotent and keep audit read-only

src/agents/pi-model-discovery.ts

@@ -15,6 +15,9 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function scrubLegacyStaticAuthJsonEntries(pathname: string): void {
+  if (process.env.OPENCLAW_AUTH_STORE_READONLY === "1") {
+    return;
+  }
   if (!fs.existsSync(pathname)) {
     return;
   }